Dell Container Storage Flaws Explained: A Six-Step Walkthrough for Admins
Dell patched multiple maximum-severity flaws in its Container Storage Modules. Here is what they do, who is affected, and how to respond, step by step.
Dell has released fixes for several critical bugs in the software that connects its enterprise storage arrays to Kubernetes. Even if containers are not your day job, storage that holds company data deserves a clear walkthrough when the vendor rates the risk this high.
The six steps
- Know what CSM is. Dell Container Storage Modules (CSM) extend the standard Container Storage Interface drivers so Kubernetes can use Dell platforms such as PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.
- Understand the first max-severity bug. CVE-2026-63688 sits in the CSM Authorization module. Because of missing authentication for critical functions, an unauthenticated remote attacker can obtain storage backend administrator credentials for registered arrays and take full administrative control of that storage.
- Understand the second. CVE-2026-63692, in the authorization proxy and tenant service, likewise lets attackers gain admin privileges by skipping authentication. Dell warns it can give complete control of the authorization service across tenants.
- Note the four other critical issues. The same day Dell also patched CVE-2026-67269 (root on cluster nodes), CVE-2026-54472 (admin access to the CSM Authorization proxy), CVE-2026-61421 (forged authentication tokens), and CVE-2026-67273 (cluster-wide read access to Kubernetes Secrets).
- Upgrade to the fixed line. Dell recommends moving CSM to version 1.18.0 or later “at the earliest opportunity.”
- Put it in context. Dell has not said these CSM bugs are already exploited, but BleepingComputer notes past abuse of other Dell flaws by groups such as Lazarus and a suspected China-backed actor tracked as UNC6201, after which CISA ordered agencies to patch affected Dell systems within three days.
What this means for your company
- Inventory first. Ask whether any Dell storage in your environment is tied into Kubernetes through CSM Authorization.
- Patch storage software like you patch servers. Critical, unauthenticated paths into storage credentials are an emergency, not a convenience upgrade.
- Limit who can reach management APIs. Even after patching, keep authorization and storage admin interfaces off the open internet.
Need help inventorying and hardening storage tied to your servers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
This walkthrough is based on BleepingComputer’s coverage of Dell’s CSM security advisory.
About The Author
